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What are we covering? 


* Key legal concepts 
e Re-use of publicly available data 
e Wealth Screening 


e Data matching/Teleappending 
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Key legal concepts 


Principle 1 DPA: 


Personal data must be processed fairly and lawfully and on 
the basis of a schedule 2 and (where necessary) schedule 3 
condition. 


Fairness - 2 parts 


* Transparency - Telling individuals who you are and what 
you are doing with their personal data. 


* Fairness - Not processing personal data in ways individuals 
would not reasonably expect. 
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Key legal concepts 


Principle 1 DPA: 

Personal data must be processed fairly and lawfully and on the 
basis of a schedule 2 and (where necessary) schedule 3 
condition. 

Only two relevant to the activities we are looking at today: 


e Consent 


e Legitimate interests 
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Key legal concepts 


Section 27(5) 


'Except as provided by this part, the subject information 
provisions shall have effect notwithstanding any enactment or 
rule of law prohibiting or restricting the disclosure, or 
authorising the withholding, of information.’ 


In simple terms - unless you can satisfy an exemption 
from within the Data Protection Act 1998, the duty to 
provide fair processing information to individuals will 


apply! 
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His 


Publicly available covers a 
range of data: 


* Electoral roll 

* Public registers (Companies 
House) 

e Press reports 

* Social media 


Key point: 

It is not fair game! 
Remember s.27(5) - You 
must still provide fair 
processing information unless 
an exemption applies! 


Wealth Screening 
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Wealth Screening 


What is it? 


Wealth Screening covers a variety of 
activities: 


* Database segmentation by post code 
* Detailed research and data collation on 


job, income, area of residence, family 
jobs etc. 


Aimed at determining likely level of 
donation or likelihood of legacy donation. 
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Wealth Screening 


Data Protection Implications 


e It involves the processing of individuals’ personal data - sometimes 
including data that they have not provided to you. 


e [t is privacy intrusive - Some acts are less intrusive than others 


e You will need a schedule condition - If relying on legitimate 
interests, remember to consider the prejudice to the rights and 
freedoms of the individual, particularly their privacy rights! 


* Fairness - Individuals would not reasonably expect this activity to 
take place. You must inform them clearly, prominently and in a way 
they will understand what this involves in terms of the use of their 
data. 
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Data matching/teleappending 
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Data matching/teleappending 


What is it? 


Data matching/teleappending covers 
activities such as: 


* Obtaining telephone numbers or email 
addresses, or 

* Obtaining up to date address details 
where it becomes apparent an 
individual has moved. 


Information Commissioner's Office 


Data Matching/ Tele-appending 


Data Protection Implications 


* This will typically involve processing personal data an individual 
never provided to you. 


* Fairness - Remember reasonable expectations! Would an individual 


reasonably expect you to call them on a number they never gave 
you? 


* Accuracy - You do not need to do this to comply with your accuracy 
obligations under the DPA. 
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summary 


Remember s.27(5) - You must provide fair processing information 
unless you have an exemption from the duty to do so. (Regardless 
of where you obtained the data from) 


Fairness - Tell people, clearly and prominently what you are doing 
with their data. Think! Would individuals reasonably expect you to 
do what you are doing? If not, the more important it is that you 
tell them and that you do so clearly, prominently and in a way 
they can understand. 


Legitimate basis - are you relying on consent or legitimate 
interests? Consent must meet all the requirements set out in the 
law. It is not sufficient to simply have a legitimate interest, you 
must balance this against the prejudice to the rights and freedoms 
of individuals. 
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Keep in touch 


Subscribe to our e-newsletter at www.ico.org.uk 
or find us on... 
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